Nasty Emails.... from ME!!!

[Stan]

Every day, it seems that I get some nasty emails, from one or more of my sites, that appear to come from none other than.....ME!!!!!

Several of the come from []Stan@adventist.ca[/] asking me to login and update my account, well, there is a virus attached. I am thankful they do not run on mac's.

SO how do you tell where an email actually comes from???? The FROM is not a reliable source at all.

SO.... WHAT IS A PERSON TO DO??

Find in your email program where you can view LONG HEADERS it will look something like this

an example of one that I got today

</font><blockquote><font class="small">Quote:</font><hr />

Delivery-Date: Tue, 05 Jul 2005 15:32:13 -0500

Received: from adventis by server3.infinitihost.com with local-bsmtp (Exim 4.44) id 1Dpu5V-0007Dz-JU for 7dating@adventistdating.com; Tue, 05 Jul 2005 15:32:13 -0500

Received: from [65.28.30.18] (helo=adventistdating.com) by server3.infinitihost.com with esmtp (Exim 4.44) id 1Dpu5U-0007Dk-Gv for 7dating@adventistdating.com; Tue, 05 Jul 2005 15:32:13 -0500

Mime-Version: 1.0

Content-Type: multipart/mixed; boundary="----=_NextPart_000_0001_130781F7.809AD134"

X-Priority: 3

X-Msmail-Priority: Normal

X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) o

<hr /></blockquote><font class="post">

This one, if you trace it down, came from 65.28.30.18 (the bolding was mine, so you could spot this better)

The go to http://www.ip-to-location.com/free.asp

and put that number in...

and you will see that this email came from

65.28.30.18 US UNITED STATES KANSAS SHAWNEE MISSION ROAD RUNNER

Usually I have found that a lot of these come from China, France, and other places...

The who use AOL, CS and Netscape generally share 6-7 IP numbers, so about 30-40% of users share 6-7 IP numbers. This caused confusion in the early days of C/A as I would see Robert, and someone on the west coast with the same IP number, then I saw lots of people with the same IP number, we live and learn.

ANY email address will let you put in any email address that you want.

Check out some of the spam you get, to see where it is actually coming from..

Banks will never ask you to login to your account, nope, not once in a while, not ever. When you follow those links, those people hijack the card number and password that you type in. If you phone the 800 number that is on the email to verify, they to are fake, and will assure you that it is ok, to log in. nasty and tricky.

I hope others will add scam preventions...

[Amelia]

Remember, sites such as your bank (online banking), credit card companies, ebay, paypal, bidpay etc. WILL NOT send you emails asking for information about your accounts. If you receive an email is it BOGUS/SPAM, out to get your personal data. If you "think" there is something really wrong with an account of any kind, DONT reply to the email or click on any links provided. BUT go direct to that companies web site and log in there, then go to "customer service" or the "contact us" page.

Never use the same log in name and password for all your registered websites.

Always combine letters, numbers and punctuation in your passwords.

Change your passwords often.

Always log out of all password protected sites when sensitive information is involved. ie Online banking sites.

Dont let the computer time log you out as that can allow a hacker to get in behind you.

[Jeannieb43]

</font><blockquote><font class="small">Quote:</font><hr />

Amelia said:

Dont let the computer time log you out as that can allow a hacker to get in behind you.

<hr /></blockquote><font class="post">

That one was news to me. Thank you!

And thank you, too, Stan. What a lot of ways there are for hackers to steal stuff from us unsuspecting victims!!

[Stan]

</font><blockquote><font class="small">Quote:</font><hr />

From: []Admin@adventist.ca[/]

Subject: Notice:***Your email account will be suspended***

Date: July 4, 2005 9:33:45 AM PDT (CA)

To: []pastorstan@adventist.ca[/]

<hr /></blockquote><font class="post">

</font><blockquote><font class="small">Quote:</font><hr />

Return-Path: <Admin@adventist.ca>

Delivery-Date: Mon, 04 Jul 2005 12:34:51 -0400

Received: from [199.185.220.223] (helo=priv-edtnes51.telusplanet.net)

by mx.perfora.net with ESMTP (Nemesis),

id 0MKvAI-1DpTuF0aDn-0007Wi for []pastorstan@adventist.ca;[/] Mon, 04 Jul 2005 12:34:51 -0400

Received: from adventist.ca ([205.250.237.194])

by priv-edtnes51.telusplanet.net

(InterMail vM.6.01.04.04 201-2131-118-104-20050224) with ESMTP

id <20050704163449.MUVE1479.priv-edtnes51.telusplanet.net@adventist.ca>

for <pastorstan@adventist.ca>; Mon, 4 Jul 2005 10:34:49 -0600

From: []Admin@adventist.ca[/]

To: []pastorstan@adventist.ca[/]

Subject: Notice:***Your email account will be suspended***

<hr /></blockquote><font class="post">

Hmmm got this one yesterday, from my website to PastorStan

AND it was sent from EDMONTON, AB....

hmmmmmm lol

[Neil D]

Quote:

---

Hmmm got this one yesterday, from my website to PastorStan

AND it was sent from EDMONTON, AB....

---

Hmmmmm, indeed...Don't we know a MODERATOR from Edmonton????

Where is that Bravus fellow anyway????

[Stan]

yeah, he is... <img src="/ubbtreads/images/graemlins/smile.gif" alt="" />

The PastorStan email address is a test email addy only for a certain email list... I suspect someone is inflitrated with a virus, from Edmonton, who is not aware of this. Those kind of viruses do not work on macs, of which he uses. I do nothing think he would have been aware of that address in anyway shape or forum....

[Stan]

</font><blockquote><font class="small">Quote:</font><hr />

From: []service@clubadventist.com[/]

Subject: Your Email Account is Suspended For Security Reasons

Date: July 5, 2005 9:03:51 PM PDT (CA)

To: []stan@clubadventist.com[/]

Return-Path: <service@clubadventist.com>

Delivery-Date: Wed, 06 Jul 2005 00:03:54 -0400

Received: from [24.74.156.182] (helo=clubadventist.com) by mx.perfora.net with ESMTP (Nemesis), id 0MKvAI-1Dq18b0LeP-0007xv for []stan@clubadventist.com;[/] Wed, 06 Jul 2005 00:03:53 -0400

Mime-Version: 1.0

Content-Type: multipart/mixed; boundary="----=_NextPart_000_0005_D31163C3.06277D7C"

X-Priority: 3

X-Msmail-Priority: Normal

Message-Id: <0MKvAI-1Dq18b0LeP-0007xv@mx.perfora.net>

X-Rbl-Warning: warn.bl.perfora.net says: This mail has been received from a dialup host.

Envelope-To: []stan@clubadventist.com[/]

<hr /></blockquote><font class="post">

Hmm another one from ClubAdventist.com telling me that my email is suspended...

this is yet another road-runner account...

[Naomi]

This is all very interesting and informative. Thank you for making us aware.

[CyberGuy]

These virus's are nasty. They get info from your computer on your address list and or you computer internet files. If you viewed a web site with emails it will view that and store it on your hard drive in the internet pages folders. The virus will find it and send out virus to everyone on your computer and randomly pick an Email address and send it. The person is not even aware this is happening.

Only sure thing is NEVER open any attachment even from friends you are not expecting an email from or does not sound like them. Common phrases in the virus header is.

Here is the file you wanted.

Here is a good joke

Check out these pics

etc

They are getting clever these virus makers. Some even sound like they came from your administrator at your office if a virus gets on someones computer at work.

[CyberGuy]

A good point. Many spam emails have a link to say to click to not allow emails again. This is a trick. If you click on it this will confirm your Email is a valid email and they will sell it to hundred or thousands of spam sites.

[NormF]

</font><blockquote><font class="small">Quote:</font><hr />

... and they will sell it to hundred or thousands of spam sites.

<hr /></blockquote><font class="post">

... who each send out thousands of spam messages per minute!!

[Nicodema]

Please use the correct terminology. A "hacker" is a self-taught programmer who reverse-engineers code in order to learn how to write code -- sort of like taking apart a radio and putting it back together to learn how it works.

The term you are looking for, to describe malicious and criminal acts of breaking into someone else's computer, is "cracker".

For real.

Nico, aspiring HACKER.